chore(deps): npm audit fix — sdk 1.29.0, systeminformation 5.31.5, +13 transitives (#585)

Clears all 15 npm audit findings (8 high / 6 moderate / 1 low):

- @modelcontextprotocol/sdk 1.25.2 → 1.29.0 (GHSA-345p-7cg4-v4c7
  cross-client data leak via shared transport reuse). Root had it
  pinned exact in devDependencies which blocked audit fix.
- systeminformation 5.30.6 → 5.31.5 (GHSA-5vv4-hvf7-2h46,
  GHSA-9c88-49p5-5ggf command injection)
- hono, undici, rollup, picomatch, minimatch, lodash-es, svelte,
  devalue, ajv, brace-expansion, markdown-it, yaml, qs — lockfile
  bumps via npm audit fix

examples/basic-server-preact/package.json

@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.0.0",
-    "@modelcontextprotocol/sdk": "^1.24.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "cors": "^2.8.5",
     "express": "^5.1.0",
     "preact": "^10.0.0",